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Metafor LLC 
137 Montague St. #260 
Brooklyn, NY 11201 


Michael F. McGowan 


Michael F. McGowan has been at the forefront of applying technology, digital forensics, data 
and statistical analyses, and investigative skills to resolving issues involving compliance and 
electronic data for over 19 years. He has been on the front lines responding to cybersecurity 
incidents ranging from opportunistic “drive-by” hacks to motivated nation-state adversaries. 


Mr. McGowan has led the technical analysis numerous high-profile matters including, 


Conducted a document authentication investigation in Ceglia v. Zuckerberg that 
established that the plaintiff had electronically forged the contract on which he sued 
Mark Zuckerberg for half of his shares in Facebook; 

Served as Major League Baseball’s expert in the arbitration over Alex Rodriguez’s 
suspension due to the use of performance enhancing drugs, which the arbiter upheld 
citing in part Mr. McGowan’s analysis of the authenticity of text messages; 

Located and analyzed the metadata of a significant document in the Enron “Barge” 
investigation. Testified at trial as the government's digital forensic expert. 

Found that a plaintiff, who had alleged that a multi-billion dollar movie franchise 
misappropriated his creative work, failed to produce relevant electronic devices for 
inspection. The lawsuit was dismissed following Mr. McGowan’s determination that files 
had been deleted from the devices shortly before the plaintiff ultimately produced them 
for inspection; 

In response to a Congressional investigation, searched servers, computers, 
smartphones, and backup tapes to recover White House senior staff emails subject to 
retention under the Presidential Records Act; 

Led a round-the-clock, court-ordered forensic examination of the adverse party’s 
electronic data in the Echostar v. Zoom litigation that uncovered a deleted, key 
document that facilitated the settlement of a multi-hundred-million-dollar case; 

Led the assessments of the functionality and suitability of AML and sanctions 
compliance systems for the monitoring of HSBC ordered by the U.S. Department of 
Justice and the Federal Reserve Board, and the monitoring of the Agricultural Bank of 
China ordered by the New York Department of Financial Services; 

Determined the technical root cause as to why financial clearing systems failed to retain 
several days of transactional history; and conducted a root cause analysis as to why 
OFAC systems did not block transactions by Specially Designated Nationals and 
individuals in sanctioned countries; and 

Established whether a collaboration software company under FTC scrutiny handled and 
deleted customer data in accordance with its stated policies by tracing and mapping 
how user data was transmitted through and stored in the company’s systems and 
whether the data privacy controls were operating effectively. 
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PROFESSIONAL EXPERIENCE 

Metafor LLC 2019 to Present 
Principal 

Founded and run a consulting and technical services company that specializes in data and 
metadata forensics and cybersecurity. 


Aon Cyber Solutions (and its predecessor, Stroz Friedberg, LLC) 2003 to 2018 
Managing Director (April 2013 to December 2018) 

Director, Digital Forensics (April 2006 to April 2013) 

Assistant Director of Computer Forensics (February 2004 to April 2006) 

Consultant and Computer Forensic Examiner (June 2003 to February 2004) 


Supervised the New York digital forensic lab of Stroz Friedberg. Testified as a digital forensic 
expert in numerous venues. 


TESTIMONY 


October 2022: Provided hearing testimony as an expert in digital forensics and cell phone 
devices in Commonwealth of Virginia v. Bhagavan Kevin Antle, V.A. Frederick Cnty. Case No. 
CR20-814-828. 


May 2022: Provided deposition testimony as a digital forensics expert in Allscripts et al. v. Andor 
Health et al., C.A. No. 1:21-cv-00704-MAK (D. Del.). 


July 2019: Provided deposition testimony as a digital forensics expert in Hall et al. v. Sargeant, 
Case No. 9:18-cv-80748-AL TMAN/Reinhart (S.D. Fla.). 


July 2017: Provided trial testimony as an expert in the area of the collection, preservation, and 
forensic analysis of electronic devices, and in particular, cellphones and smartphones in State of 
New Jersey v. Michael Doce, N.J. Middlesex Cnty. Indictment No. 12-05-00855. 


June and July 2014: Provided hearing testimony as an expert in the area of the collection, 
preservation, and forensic analysis of electronic devices, and in particular, cellphones and 
smartphones in State of New Jersey v. Michael Doce, N.J. Middlesex Cnty. Indictment No. 12- 
05-00855. 


October and November 2013: Provided hearing and rebuttal testimony as a digital forensics 
expert in /n the Matter of Arbitration between Major League Baseball Players Association and 
the Office of the Commissioner of Baseball, Grievance No. 2013-02 (Alexander Rodriguez) in 
New York, NY. 


April 2013: Provided testimony about a digital forensic examination in /n the Matter of Certain 
Rubber Resins and Processes for Manufacturing Same, US Int'l Trade Comm'n., Investigation 
No. 337-TA-849. 


January 2013: Provided deposition testimony as a digital forensics and data analytics expert in 
Reed Construction Data Inc. v. The McGraw-Hill Companies, Inc., et al., 09 CV 8578 (JPO) 
(S.D.N.Y.). 


July 2012: Provided deposition testimony as a digital forensics expert in Paul D. Ceglia v. Mark 
Elliott Zuckerberg, Individually, and Facebook, Inc., 1:10-cv-O0569-RJA (W.D.N. Y.) 


February 2012: Provided testimony as a digital forensics expert at a spoliation hearing in Alycia 
Lane v. CBS Broadcasting, Inc., et al., Ct. Com. Pl., Phila. Co., Sept. Term, 2008, No. 03425. 


Case 1:22-cr-00673-LAK Document 99-2 Filed 03/01/23 Page 4 of 8 


January 2012: Provided trial testimony as a digital forensics expert in Donald G. Drapkin v. 
MAFCO Consolidated Group, Inc., 09 Civ. 1285 (PGG) and MacAndrews & Forbes LLC v. 
Donald G. Drapkin, 09 Civ. 4513 (S.D.N_Y.). 


July 2011: Provided deposition testimony as a digital forensics expert in Sartomer USA v. Earl 
Emerson, et al., CCP, Chester County, No. 10-07708. 


May 2010: Provided deposition testimony as a digital forensics expert in Donald G. Drapkin v. 
MAFCO Consolidated Group, Inc., 09 Civ. 1285 (PGG) and MacAndrews & Forbes LLC v. 
Donald G. Drapkin, 09 Civ. 4513 (S.D.N.Y.). 


December 2009: Testified as a digital forensics expert in Suryawanshi et al. v. UBS AG et al., 
FINRA Arbitration (FINRA No. 09-02568). 


April 2009: Provided deposition and court testimony as a digital forensics expert in Flying Disc 
Investments L.P., et al., v. Baker Communications Fund II, L.P., et al., Super. Ct. of Cal. (CGC 
05447294). 


June 2007: Testified as a digital forensics expert in U.S. v. Zafar, 06-CR-289 (E.D.N.Y.). 


July 2005: Testified as a digital forensics expert in Wall Street Network LTD v. The New York 
Times Co., et al., Super. Ct. of Cal. (BC 304596). 


December 2004: Testified as a digital forensics expert in Gerner, et al. v. Applied Indus. 
Materials Corp., et al, Super. Ct. Conn. 


October 2004: Testified as a digital forensics expert in U.S. v. Bayly, et al., H-03-cr-363 (S.D. 
Tex). 


June 2004: Testified regarding a digital forensics protocol in Adkins v. General Motors Corp., et 
al., 03 CV 3613 (JS) (E.D.N.Y.). 


June 2004: Testified as a digital forensics expert in Philip Morris USA, Inc. v. Otamedia, Ltd., 02 
Civ. 7575 (GEL) (S.D.N.Y). 


LECTURES AND PRESENTATIONS 


September 2021: Participated in a panel discussion on “Assuring Technical Privacy 
Compliance,” hosted by the Privacy + Security Forum. 


October 2019: Lectured and participated in a panel discussion on “Identifying, Preparing and 
Presenting Expert Witnesses,” hosted by the Criminal Trial Advocacy Institute at the New 
Jersey Law Center. 


February 2019: Spoke on a continuing legal education panel on “How Can Law Firms and Legal 
Service Providers Combat Cybersecurity Issues” hosted by the Practising Law Institute. 


March 2018: Participated in a panel discussion on incident response, digital forensics, and data 
breaches hosted by the Business Law Section of the American Bar Association. 


January 2018: Spoke on a continuing legal education panel on “Select Issues in Digital 
Evidence, Social Media, and Discovery” hosted by the Heckel Inn of Court at Rutgers Law 
School. 


January 2018: Delivered a continuing legal education lecture titled “Cybersecurity Best 
Practices for Legal Services Providers” hosted by the Practising Law Institute. 


October 2017: Participated in a panel discussion titled “Cybersecurity Issues concerning 
Internet of Things devices” hosted by the Legal Information Institute at Cornell Law School. 
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September 2016: Participated in a panel discussion titled “Legal and Practical Problems of 
Security in a Fast Moving FinTech World” at the FinTech Forum Silicon Valley hosted by the 
George Washington University School of Law. 


June 2014: Delivered a lecture titled “Digital Security and You” at the Down Town Association in 
New York, NY. 


April 2014: Participated in a panel discussion webinar about smartphone evidentiary issues co- 
hosted by Davis Polk. 


June 2013: Led a round table discussion on the topic of Bring Your Own Device (“BYOD”) and 
its impacts on IT security and digital forensics at the Fordham ClO Roundtable. 


May 2012: Delivered a lecture titled “Computer Forensics Demonstration” at the Internet 
Technology Basics for Judges Conference hosted by the Center on Law and Information Policy 
at Fordham Law School. 


September 2011: Delivered a lectured titled “Cloud Computing Investigations” at the National 
Forensic Accounting Conference hosted by the American Institute of Certified Public 
Accountants. 


September 2010: Delivered a lecture titled “Social Networking Forensics” at the High 
Technology Crime Investigation’s International Conference in Atlanta, GA. 


June 2010: Participated in a panel discussion on evidentiary issues regarding social network 
websites hosted by the New York City chapter of Women in E-Discovery. 


May 2010: Delivered a lecture at the Cyber Security and Applications seminar at Fordham 
University. 

April 2010: Delivered a lecture titled “Web Browsing: Neither Discreet Nor Discrete” at the 
Computer Forensic Show. 


April 2009: Co-presented a lecture titled “Digital Forensics in a Business Use: A Case Study in 
Recovering DNA from a Hard Drive” at the John Jay Center for Cybercrime Studies. 


April 2008: Delivered a lecture titled “E-Discovery and IP Theft” to the New York chapter of 
InfraGard. 


May 2007: Co-presented at a seminar for the Business Law Section of the New York State Bar 
Association titled “Hidden Data: Its Dangers and Traps for the Unwary.” 


PUBLICATIONS 


November 2020: Co-authored “Navigating a Ransomware Response in Light of Recent OFAC 
Guidance,” a Risk Assistance Network + Exchange advisory. 


November 2007: Co-authored “Electronic Discovery Behind Enemy Lines: Inspection Of An 
Adversary’s Network Pursuant To FRCP 34(a)” in Metropolitan Corporate Counsel. 


October 2006: Co-authored “Lost Back-up Tapes, Stolen Laptops and Other Tales of Data 
Breach Woe” in Computer and Internet Lawyer. 


September 2005: Co-authored “Electronic Discovery Technology” in Adam Cohen and David 
Lender’s treatise Electronic Discovery: Law and Practice. 


May 2004: Co-authored “Your Company’s Computer System’ in E Discovery: A Guide for 
Corporate Counsel by Sills Cummins Epstein & Gross P.C. 
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EDUCATION 


University of Chicago 
B.A. Economics and Statistics with General Honors, 2003. 


CERTIFICATIONS 

GIAC Advanced Smartphone Forensics — 2021 to present 

Chainalysis Cryptocurrency Fundamentals Certification (CCFC) — 2021 to 2023 
Certified Information Systems Auditor (CISA) — 2015 to present 

Chainalysis Reactor Certification — 2020 to 2021 

EnCase Certified Forensic Examiner (EnCE) — 2004 to 2016 


TRAINING 


SANS Institute, 2022 

Windows Forensic Analysis 

Attended training course on the acquisition and analysis of electronic data from computers 
running the Windows operating system. 


SANS Institute, 2022 

Digital Forensics and Incident Response Summit 

Attended training conference on current topics in digital forensic and incident response, 
including analyzing cloud-based evidence, smartphones, and other data sources. 


Digital Forensic Research Workshop, 2022 
Attended annual conference on current digital forensic research. 


Mid-Atlantic Association of Forensic Scientists (“MAAFS”) Annual Meeting, 2022 
Forensic Examination of Handwritten Electronic Signatures 

Attended workshop on the methodology and techniques for examining handwritten electronic 
signatures. 


Cybersecurity Docket, 2022 
Incident Response Forum Ransomware 2022 
Attended conference on mitigating and responding to ransomware attacks. 


International Association of Privacy Professionals (“IAPP”), 2021 

Privacy in Technology Online Training 

Attended training course on privacy principles and measures for designing systems and 
software to ensure better privacy. 


SANS Institute, 2021 
Smartphone Forensic Analysis In-Depth 
Attended training course on the acquisition and analysis of iOS and Android smartphones. 


Program on Corporate Compliance and Enforcement at NYU School of Law, 2021 
Confronting Cybersecurity and Data Privacy Challenges in Times of Unprecedented Change 
Attended conference on cybersecurity and data privacy risks and related regulatory and 
enforcement actions. 
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Chainalysis Cryptocurrency Fundamentals, 2021 
Attended training course about cryptocurrency technologies, financial crime risks, and 
investigations. 


Chainalysis Reactor Certification, 2020 
Attended training course on conducting cryptocurrency investigations. 


National White Collar Crime Center (“NWC3”), 2020 

Cryptocurrency, Compliance, and Financial Crimes 

Attended webinar on legal, regulatory, and technical considerations for investigating 
cryptocurrencies. 


SANS Institute, 2020 
Digital Forensics & Incident Response Summit 
Attended lectures on digital forensic research. 


Magnet Forensics, 2020 

Magnet Cloud and Internet Investigations 

Attended training course on the identification, preservation, and analysis of cloud-based and 
online digital evidence. 


Magnet Forensics, 2019 

Magnet AXIOM Examinations 

Attended training course on digital forensic examinations of computers, USB drives, cloud- 
based data, and smartphones. 


National White Collar Crime Center (“NWC3”), 2019 
To the Cloud! Get the Evidence You Need to Move Cases Forward 
Attended webinar on legal and technical considerations for cloud-based digital evidence. 


Cellebrite, 2017 
Mobile Device Forensic Fundamentals Concepts 
Attended training course on the identification and handling of mobile device evidence. 


Association of Certified Anti-Money Laundering Specialists, 2016 
Attended lectures concerning examining anti-money laundering systems and analytical 
techniques. 


Volatility Project, 2013 

Windows Malware and Memory Forensics Training Course 

Attended training focused on malware analysis and the forensic preservation and analysis of 
memory from Windows operating systems. 


HTCIA International Conference, 2010 
Attended lectures concerning mobile device forensics and incident response. 


Digital Forensic Research Workshop, 2007 
Attended annual conference on current digital forensic research. 
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SANS Institute, 2007 

Hacker Techniques, Exploits & Incident Handling 

Attended training course on identifying computer vulnerabilities and responding to computer 
incidents. 


SANS Institute, 2005 

System Forensics, Investigation & Response 

Attended training concerning digital forensics and incident response covering file system 
structures, network response, and malicious code review. 


Guidance Software, 2003 

EnCase Intermediate Analysis and Reporting 

Attended core training course on general digital forensic issues and the use of Guidance 
Software’s EnCase digital forensic software to analyze electronic data. 


Stroz Friedberg Internal Cyber Training Program, 2003 - 2017: Participated in regular 


in-house training presentations on current digital forensics, cybercrime response, computer 
security, desktop, and network forensics tools. 


As of February 2023 


